Setup question with VPN on Linksys E2000

Alaza

Hi there.

I've just bought a Linksys E2000 so setup an OpenVPN solution at home. So I'm running a Zyxel router with DHCP (which I need for other applications) and then I've plugged my Linksys E2000 into it. Note that the firmware running on the E2000 is Tomato with VPN. Additionally, I've forwarded port 1194 from the Zyxel router to the Linksys router.

So now I've created certificates for the server and my Windows 7 setup for starters, and copied them into my E2000 VPN setup. However, I can't seem to get the connection established:

Tue Apr 03 15:10:34 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Apr 03 15:10:34 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Apr 03 15:10:34 2012 LZO compression initialized
Tue Apr 03 15:10:34 2012 Control Channel MTU parms [ L:1592 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Apr 03 15:10:34 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Apr 03 15:10:34 2012 Data Channel MTU parms [ L:1592 D:1450 EF:60 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Apr 03 15:10:34 2012 Local Options hash (VER=V4): '39ac68d4'
Tue Apr 03 15:10:34 2012 Expected Remote Options hash (VER=V4): 'de0ebdfe'
Tue Apr 03 15:10:34 2012 Attempting to establish TCP connection with 10.0.0.34:1194
Tue Apr 03 15:10:34 2012 TCP connection established with 10.0.0.34:1194
Tue Apr 03 15:10:34 2012 TCPv4_CLIENT link local: [undef]
Tue Apr 03 15:10:34 2012 TCPv4_CLIENT link remote: 10.0.0.34:1194
Tue Apr 03 15:10:34 2012 TLS: Initial packet from 10.0.0.34:1194, sid=3182e689 edafa001
Tue Apr 03 15:10:34 2012 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=DK/ST=CPH/L=Copenhagen/O=OVPN/CN=server/emailAddress=me@myhost.mydomain
Tue Apr 03 15:10:34 2012 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Tue Apr 03 15:10:34 2012 TLS Error: TLS object -> incoming plaintext read error
Tue Apr 03 15:10:34 2012 TLS Error: TLS handshake failed
Tue Apr 03 15:10:34 2012 Fatal TLS error (check_tls_errors_co), restarting
Tue Apr 03 15:10:34 2012 TCP/UDP: Closing socket
Tue Apr 03 15:10:34 2012 SIGUSR1[soft,tls-error] received, process restarting
Tue Apr 03 15:10:34 2012 Restart pause, 5 second(s)

I hope you get more out of this than me, because I can't see to determine the error.

I'm running TAP, TCP on port 1194.

janjust

the client does not trust the server-supplied certificate; check the ca.crt files on both sides and make sure that you're using certificates issued by the same CA on both sides.

Alaza

I just tried to re-create all of the certificates, with the same result. I create the CA certificate, along with the client- and serverside certificate, and finally the Diffie Hellman parameters. And from the easy-rsa folder I copy the ca.crt, client1.crt and client1.key to the config folder on the client computer.

Afterwards I edit the CA.crt, server.crt, server.key and dh1024.pem and cp the certificate, private key and DH parameters into the router-server-side. And then I get this again:

Tue Apr 03 22:13:47 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Apr 03 22:13:47 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Apr 03 22:13:47 2012 LZO compression initialized
Tue Apr 03 22:13:47 2012 Control Channel MTU parms [ L:1592 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Apr 03 22:13:47 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Apr 03 22:13:47 2012 Data Channel MTU parms [ L:1592 D:1450 EF:60 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Apr 03 22:13:47 2012 Local Options hash (VER=V4): '39ac68d4'
Tue Apr 03 22:13:47 2012 Expected Remote Options hash (VER=V4): 'de0ebdfe'
Tue Apr 03 22:13:47 2012 Attempting to establish TCP connection with 10.0.0.34:1194
Tue Apr 03 22:13:47 2012 TCP connection established with 10.0.0.34:1194
Tue Apr 03 22:13:47 2012 TCPv4_CLIENT link local: [undef]
Tue Apr 03 22:13:47 2012 TCPv4_CLIENT link remote: 10.0.0.34:1194
Tue Apr 03 22:13:47 2012 TLS: Initial packet from 10.0.0.34:1194, sid=51739050 b58eb0e2
Tue Apr 03 22:13:47 2012 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=OpenVPN-Polaric/name=changeme/emailAddress=mail@host.domain
Tue Apr 03 22:13:47 2012 VERIFY OK: nsCertType=SERVER
Tue Apr 03 22:13:47 2012 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=Polaric-Server/name=changeme/emailAddress=mail@host.domain
Tue Apr 03 22:13:47 2012 Connection reset, restarting [-1]
Tue Apr 03 22:13:47 2012 TCP/UDP: Closing socket
Tue Apr 03 22:13:47 2012 SIGUSR1[soft,connection-reset] received, process restarting
Tue Apr 03 22:13:47 2012 Restart pause, 5 second(s)

janjust

that is a different error:

Tue Apr 03 22:13:47 2012 Connection reset, restarting [-1]

something is resetting the connection, check for any firewalls that might block access

Alaza

I've tried to disable Windows firewall, but it doesn't seem to chance anything. Additionally I've closed Ad-Aware running and the AVG Resident Shield (not that it's firewalls though). In terms of routers I'm behind the Zyxel which runs DHCP in the 10.0.0.x range, and then the Linksys E2000 runs only VPN with the IP 10.0.0.34, as shows in the log. In the Zyxel router I then have forwarded port 1194 to the Linksys router, but I guess that only applies for connections outside the house.

What else could I try?

Wed Apr 04 06:53:25 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed Apr 04 06:53:25 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Apr 04 06:53:25 2012 LZO compression initialized
Wed Apr 04 06:53:25 2012 Control Channel MTU parms [ L:1592 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Apr 04 06:53:25 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Apr 04 06:53:25 2012 Data Channel MTU parms [ L:1592 D:1450 EF:60 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Apr 04 06:53:25 2012 Local Options hash (VER=V4): '39ac68d4'
Wed Apr 04 06:53:25 2012 Expected Remote Options hash (VER=V4): 'de0ebdfe'
Wed Apr 04 06:53:25 2012 Attempting to establish TCP connection with 10.0.0.34:1194
Wed Apr 04 06:53:25 2012 TCP connection established with 10.0.0.34:1194
Wed Apr 04 06:53:25 2012 TCPv4_CLIENT link local: [undef]
Wed Apr 04 06:53:25 2012 TCPv4_CLIENT link remote: 10.0.0.34:1194
Wed Apr 04 06:53:25 2012 TLS: Initial packet from 10.0.0.34:1194, sid=379b565b 07cc2435
Wed Apr 04 06:53:26 2012 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=OpenVPN-Polaric/name=changeme/emailAddress=mail@host.domain
Wed Apr 04 06:53:26 2012 VERIFY OK: nsCertType=SERVER
Wed Apr 04 06:53:26 2012 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=Polaric-Server/name=changeme/emailAddress=mail@host.domain
Wed Apr 04 06:53:26 2012 Connection reset, restarting [0]
Wed Apr 04 06:53:26 2012 TCP/UDP: Closing socket
Wed Apr 04 06:53:26 2012 SIGUSR1[soft,connection-reset] received, process restarting
Wed Apr 04 06:53:26 2012 Restart pause, 5 second(s)

janjust

what does the VPN server (i.e. the linksys) show in the log files? this is one of the issues with the tomato/dd-wrt packaged version of openvpn - I have no clue how to get the low level log file.